jarredhj0214 opened a new pull request, #12671: URL: https://github.com/apache/gravitino/pull/12671
### What changes were proposed in this pull request? This PR updates authorization denial messages generated by `GravitinoInterceptionService` to show the full `NameIdentifier` of the denied metadata object instead of only the last segment. For example, a table authorization failure now reports metadata like: ```text metalake.catalog.schema.table instead of: table A unit test is added to cover multi-segment NameIdentifier rendering in the no-auth response. Why are the changes needed? When different catalogs or schemas contain metadata objects with the same name, showing only NameIdentifier.name() makes authorization failures harder to diagnose. Showing the full NameIdentifier helps users identify the exact denied resource directly from the 403 error message. Fixes #12670 Does this PR introduce any user-facing change? Yes. The diagnostic text in 403 authorization denial messages changes from the last metadata name segment to the full NameIdentifier. This does not change authorization logic, HTTP status codes, error response structure, response fields, or user permissions. How was this patch tested? Added a unit test in TestGravitinoInterceptionService to verify that authorization denial messages include the full metadata NameIdentifier. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
